CVE-2026-102982

UNKNOWN 0.0

Plane: XSS in work item comments

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.

CWE	CWE-79
Vendor	makeplane
Product	plane
Published	Oct 13, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for makeplane plane

Be the first to know when new unknown vulnerabilities affecting makeplane plane are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

makeplane / plane

< 1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j github.com: https://github.com/makeplane/plane/pull/9287 github.com: https://github.com/makeplane/plane/commit/0d58adb69d859fc94c43b9d68fadd77e810d5ed1 github.com: https://github.com/makeplane/plane/releases/tag/v1.4.0